Solved Local Security Authority: good or bad?

I noticed a warning that my Local Security Authority protection is off, and followed the links to find help on it, but I'm not sure whether to trust the simple explanation about keeping unsigned drivers and plugins from loading. The increasing AI injection in everything is making me paranoid: I've got Copilot off and don't want AI anywhere near my PC's OS, thank you very much. Another thought is whether this is unnecessary if I don't allow AI, and if putting it on has negative consequences such as stopping non-Windows-approved software from running, etc.

Being asked if I want it on suggests I might want it off, and if something is necessary for security and doesn't have downsides, I expect it to be automatically installed, so that makes me question it.

The LSA process can have a lot of sensitive data stored in process memory. Running LSASS as a protected process helps protect the process memory from credential dumping attacks like Mimikatz. It's highly unlikely turning it on would impact anything, but also it's not as useful a feature in a home network. You can enable it from 'Device Security' under Windows Security or via GPO/regedit

lettersquash said:

I noticed a warning that my Local Security Authority protection is off, and followed the links to find help on it, but I'm not sure whether to trust the simple explanation about keeping unsigned drivers and plugins from loading. The increasing AI injection in everything is making me paranoid: I've got Copilot off and don't want AI anywhere near my PC's OS, thank you very much. Another thought is whether this is unnecessary if I don't allow AI, and if putting it on has negative consequences such as stopping non-Windows-approved software from running, etc.

Being asked if I want it on suggests I might want it off, and if something is necessary for security and doesn't have downsides, I expect it to be automatically installed, so that makes me question it.

Click to expand...

I am not recommending whether you should or shouldn't have it on, just providing informtaion.
Yes — for nearly all Windows 11 Pro users there is a good reason to turn Local Security Authority (LSA) protection on.

What it does​

LSA protection runs the critical LSASS.exe process (Local Security Authority Subsystem Service) as a Protected Process Light (PPL). This stops non-Microsoft-signed code from injecting into or reading LSASS memory. LSASS holds credentials in memory (passwords, NTLM hashes, Kerberos tickets, etc.), so this is a strong defense against credential-dumping tools (e.g., Mimikatz) and related attacks such as pass-the-hash.


Microsoft introduced the feature in Windows 8.1 / Server 2012 R2 and has continued to strengthen it. On newer clean installs of Windows 11 (22H2 and later) it is often enabled by default under certain conditions; on upgraded systems or many Pro machines it is frequently off.

Why you should enable it​

• It meaningfully raises the bar against credential theft with very little downside for most people.
• Performance impact is typically negligible on modern hardware.
• It is considered a best-practice hardening step and is recommended by Microsoft and security guides.
• Leaving it off makes the system more vulnerable to common attack techniques that target LSASS.

When you might leave it off (or need to turn it back off)​

The main reasons are compatibility, not performance:

• Some third-party software tries to load plugins/drivers into LSA (smart-card drivers, certain cryptographic modules, password filters, SSO tools, older security software, Apple Bonjour/iTunes components, some VPN clients, etc.). These fail if they are not properly Microsoft-signed.
• Very rare legacy applications that expect unrestricted access to LSASS.
• Development/debugging of custom LSA plugins (not relevant for normal use).

If enabling it breaks something specific, you can turn it off again. For a typical gaming, productivity, or general-purpose Pro machine the compatibility issues are uncommon.

How to enable it​

1. Open Windows Security → Device security → Core isolation details.
2. Turn on Local Security Authority protection.
3. Restart when prompted.

(Alternative methods via Group Policy or registry exist if the toggle is missing or unresponsive, but the Settings path is the simplest for most users.)


Bottom line: Turn it on unless you have a specific, known compatibility problem. The security benefit is real and the cost for ordinary use is very low.

Many thanks.